Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem, specifically within the Netfilter framework used for firewalling and packet filtering. The issue affects how the system validates incoming network traffic against security policies when multiple security transforms (like IPsec) are applied. An exploit could lead to inconsistent policy enforcement, potentially allowing traffic to bypass intended security restrictions or causing unexpected network behavior.
Technical details
A logic error exists in the match_policy_in() function within net/netfilter/xt_policy.c of the Linux kernel. The function iterates through security path (sec_path) entries in reverse order (from the last transform to the first), but fails to correctly map these to the policy array (info->pol[]) which expects forward-order matching in strict mode. This results in an incorrect 'pos' calculation for multi-element inbound rules. An attacker could potentially leverage this inconsistency to bypass security policy matches. The fix adjusts the position calculation to derive the correct index based on the number of transforms already processed, ensuring consistent forward-order matching.
Affected products
- Linux Linux 2.6.17 to 5.10.258, 5.15.209, 6.1.175, 6.6.x
Timeline
- 2026-04-17: other: Vulnerability fixed in kernel source
- 2026-06-24: advisory: CVE published by NVD
References
- https://git.kernel.org/stable/c/392cc1d8408b5665215c1e9290bbf0f92339b043
- https://git.kernel.org/stable/c/4b2b4d7d4e203c92db8966b163edfacb1f0e1e29
- https://git.kernel.org/stable/c/82664d0f1ba25e4f9a71994954abae24c60f4067
- https://git.kernel.org/stable/c/938867e870fb5471bb16f442aeac81326e05bf65
- https://git.kernel.org/stable/c/b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9
- https://git.kernel.org/stable/c/eb323f7b82d2e2f638de0cc2a177803eb20e0707
- https://git.kernel.org/stable/c/f98b7f85e04b40e28b08c461ded0cc79f14f5509